Permissive authenticator for local dev — ALL requests get full scope.
Called for every inbound request. Returns the auth scope for the caller, or null/undefined if the request must be rejected with 401.
Permissive authenticator for local dev — ALL requests get full scope.